Detection of misuse or abuse of data by authorized access to database

Abstract

The present invention relates to a system for detecting misuse and/or abuse of data related to database done by a user with authorized access to a data system and its database. User behavior is monitored as to its nature of database access, analyzed to create, and compare to, a specific profile. No understanding for the meaning of data content is needed. Each deviation from normal pattern, stored in the profile, is checked in various parameters and ranked, reporting to a system owner.

1 . A method for identifying a misuse and/or abuse of authorized access to a database of a data gathering system by a user, comprising: a) constructing a user and/or terminal profile representing a pattern of database's accesses; b) monitoring user and/or terminal database access; c) comparing the monitored database access' information with existing profile to determine anomalies and/or irregularities; and d) identifying a potential misuse and/or abuse when an anomaly is detected.  
   
   
       2 . The method for identifying a misuse and/or abuse of authorized access to a database of a data gathering system by a user according to  claim 1 , further comprising: a) comparing the anomalies to the user and/or terminal profile's parameters and grade it accordingly; b) reporting a potential misuse and/or abuse when the grade exceeds a predetermined threshold; and c) update profile according to comparison results and/or system owner instructions.  
   
   
       3 . The method for identifying a misuse and/or abuse of authorized access to a database of a data gathering system by a user according to  claim 2 , further comprising: a) constructing a profile for a group of users and/or terminals, representing a pattern of database's accesses related to that group; b) comparing database access' parameters of a specific user and/or terminal with existing related group profile to determine anomalies and/or irregularities.  
   
   
       4 . The method for identifying a misuse and/or abuse of authorized access to a database of a data gathering system by a user according to claim  1 - 3 , wherein a) there is no need to understand and/or analyze the context of the actual data been manipulated and/or processed by a user; and b) the characteristics of each database access do not need to be predefined.  
   
   
       5 . The method for identifying a misuse and/or abuse of authorized access to a database of a data gathering system by a user according to claim  1 - 3 , wherein the parameters of a profile are: a) commonly used statistics terms and/or any mathematical model and/or other figure or term, representing behavior and/or occurrence over any timeframe; and b) combine, part or all of: user identification, terminal and/or port identification, key characteristics of a database access, time stamp of the access.  
   
   
       6 . The method for identifying a misuse and/or abuse of authorized access to a database of a data gathering system by a user according to claim  1 - 3 , wherein the parameters and/or the depth of a profile are flexible and subject to a system owner's decisions with respect to time frames and levels of database segments.  
   
   
       7 . The method for identifying a misuse and/or abuse of authorized access to a database of a data gathering system by a user according to claim  1 - 3 , wherein the related operations are executed in real-time, near real-time and/or on-line with the occurrence of database access, or off-line, batch mode and/or long after the actual access to database has been occurred.  
   
   
       8 . The method for identifying a misuse and/or abuse of authorized access to a database of a data gathering system by a user according to claim  1 - 3 , wherein the machines, servers and/or any related hardware of the data gathering system are singular or plural, distributed geographically and/or logically, and where database is singular or plural, distributed geographically and/or logically.  
   
   
       9 . The method for identifying a misuse and/or abuse of authorized access to a database of a data gathering system by a user according to claim  1 - 3 , wherein a) the system owner can indicate specific segment/s within a database to be more sensitive than others and/or with predefined weight, for each desired segment, to be calculated accordingly in grading a warning or alarm; and/or b) the system owner can indicate specific user/s and/or terminal/s to be monitored and referenced with more sensitivity than others and/or with predefined weight, for each desired user or terminal, to be calculated accordingly in grading a warning or alarm.